fix(recovery): tolerate -shm sidecars when WAL is safe (issue #51)

[pablontiv]

Root Cause

The recover --dry-run command fails with "unexpected SQLite sidecar namespace entry" when recovering against a WAL-mode database with a -shm file, even when the -wal file is zero bytes (indicating no pending changes).

The chicken-and-egg bug:

1. Startup phase (index_prepare) opens the database → creates -shm sidecar
2. Recovery handler runs and calls ensureSourceSidecarsSafe
3. Sidecar check rejects the -shm file that startup just created

Root cause: ensureSourceSidecarsSafe rejected -shm unconditionally, without considering whether the database had active writers. A zero-byte -wal file guarantees no uncheckpointed changes, meaning no active writer is modifying the database.

Solution (Approach B)

Modified ensureSourceSidecarsSafe to tolerate -shm files when the -wal is zero bytes or absent, matching the existing logic for -wal files. The safety property is preserved: if WAL has no pending changes, -shm is safe to tolerate.

This is narrower and more surgical than approach (A) which would skip the entire startup phase for recover commands.

Safety Property

• Zero-byte -wal file = no uncheckpointed changes
• No uncheckpointed changes = no active writer
• No active writer = -shm is safe to read immutably
• Therefore: tolerating -shm when -wal is safe maintains the invariant

Tests

Added unit tests (internal/recovery/recovery_test.go):

• TestEnsureSourceSidecarsToleratesZeroByteWAL: confirms zero-byte -wal is tolerated
• TestEnsureSourceSidecarsToleratesSHMWithZeroWAL: new fix - tolerates -shm when -wal is zero
• TestEnsureSourceSidecarsToleratesSHMWithoutWAL: new fix - tolerates -shm when -wal is absent
• TestEnsureSourceSidecarsRejectsSHMWithNonZeroWAL: verifies -shm is still rejected when -wal has pending changes

Added CLI integration test (cmd/backscroll/main_test.go):

• TestRecoverDryRunWithWALSidecars: reproduces and verifies issue bug: recover --from <active-db> rejects the -shm sidecar its own startup creates #51 fix - recover --dry-run succeeds against a WAL-mode database with -shm sidecar

Updated existing test:

• TestRecoverSQLiteSidecarPolicy/empty_active_shm_tolerated_before_replacement: changed from expecting rejection to expecting tolerance (now verifies the fix)

Verification

$ just ci
Coverage: 86.5%  ✓

All tests pass, coverage maintained above 85% gate.

Closes #51

https://claude.ai/code/session_019LDXzStaKrArqJKvy4z3eF